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We reviewed Top Secret/Sensitive Compartmented Information (TS/SCI) systems under 
the Department of Homeland Security's (DHS) purview. We focused on DHS' 
information assurance posture, including the policies and procedures in place for the 
department's intelligence systems. We performed our work at the departmental and 
organizational component levels, focusing on the system security controls for a subset of 
intelligence systems, according to the requirements in Director of Central Intelligence 
Directive 6/3, Protecting Sensitive Compartmented Information Within Information 
Systems. 

The objective of our evaluation was to determine whether DHS' information security 
program and practices are adequate and effective in protecting the information and the 
systems that support DHS' intelligence operations and assets from unauthorized access, 
use, disclosure, disruption, modification, or destruction. We also determined whether 
DHS' privacy program and related activities pertain to its intelligence systems, and 
identified whether components have developed or incorporated requirements to protect 
intelligence system vulnerabilities into their classification guides. Furthermore, we 
conducted detailed assessments of security controls and documentation for DHS' 
intelligence systems and assessed the mitigation of system security weaknesses 
previously identified as a result of system security vulnerability assessments conducted 
for a subset of intelligence systems in Fiscal Years 2004 and 2005. Fieldwork was 
conducted from May through August 2006. 

DHS formally established the Office of Intelligence and Analysis to implement the 
department's Information Technology security program for its intelligence systems and 
assets. We also identified issues regarding the certification and accreditation of DHS' 
intelligence systems; Plan of Action and Milestones process; incident detection, handling 
procedures, reporting, and analysis process; and information security training and 
awareness program for all users of intelligence systems and specialized training for 
employees with significant security responsibilities for DHS' intelligence systems. We 
recommended that DHS formally grant the Office of Intelligence and Analysis' Chief 
Information Officer the comprehensive authority to support the management, operation, 
and DCID 6/3 accreditation of the department's intelligence systems, excluding United 
States Coast Guard intelligence data systems. DHS management agreed with our 
recommendation and has begun taking actions to address the issues raised during our 
review. (OIG-07-15, December 2006) 
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